Verifying RPM digital signature

The Cloud Application Business Insights RPM files are digitally signed to assure the users that the application performs as intended. Code signing acts as a proof that the files are not corrupted or tampered.

About this task

Starting in version 1.1.7, all the Cloud Application Business Insights RPM installation files are signed by IBM to protect their integrity and authenticity. Every RPM file is shipped with an associated signature file and a public key.

Procedure

  1. Download and copy the electronic installation image for Cloud Application Business Insights application to a location of your choice.
    For example, /home/INSTALLERS/icabi, which is referred to as DIST_DIR1.
  2. Extract the software by using the following command: 
    icabi_1.1.7.0_xlinux.tar
  3. Go to the bin folder.
    The bin folder contains the following RPM files that can be verified and a public key file that is required for the verification:
    • prd_1.1.7.0-0-1.x86_64.rpm

      This RPM package is to install the Cloud Application Business Insights application.

    • prd_WLP_installer-1.1.7.0-0-1.x86_64.rpm

      This RPM package is to install WebSphere® Application Server Liberty.

    • public-key.pgp

      This file contains the key that is needed for verifying the RPM files.

  4. Run the following command to import the public key:
    rpm --import public-key.pgp
  5. Run the following command to verify the signatures for each RPM file:
    rpm -Kv <filename.rpm>

    For example,

    • rpm -Kv prd_1.1.7.0-0-1.x86_64.rpm
    • rpm -Kv prd_WLP_installer-1.1.7.0-0-1.x86_64.rpm

    The command returns Verified OK message. The message indicates that the RPMs are safe to use.